# Liquid Network Stays Paused With 598 Bitcoin Unreturned After Software Approved an Unbacked Withdrawal

Eleven of the federation's fifteen keys signed the peg-out that removed about 4,000 of 4,200 bitcoin, so no key was stolen and no contract was tricked.

- Published: 2026-09-21T05:47:19.973Z
- Canonical: https://polylog.news/crypto/2026-09-21/liquid-network-stays-paused-with-598-bitcoin-unreturned-afte
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CryptoSlate](https://cryptoslate.com/who-pays-when-bitcoin-disappears-without-anyone-stealing-the-keys/), [Rekt News](https://www.rekt.news/)

Almost 4,000 bitcoin left the reserve backing Blockstream's Liquid sidechain on 6 September through a withdrawal the network itself approved, and the case is still unresolved. [CryptoSlate's account](https://cryptoslate.com/who-pays-when-bitcoin-disappears-without-anyone-stealing-the-keys/) makes the uncomfortable point plainly: the private keys used to authorize the transfer were never stolen. Software accepted a withdrawal that should never have qualified.

Liquid lets holders move a bitcoin-backed token, L-BTC, across a federated sidechain, with real bitcoin locked in a multi-signature wallet run by the federation. Early analysis pointed to a defect in Elements, the software Liquid runs on, which let the attackers create L-BTC that no bitcoin ever backed and then redeem it. Eleven of the fifteen federation keys signed the resulting peg-out, which is exactly what those keys are designed to do when a request looks valid. Roughly $320 million in bitcoin left through a process that was functioning exactly as designed.

The attackers left an on-chain message describing themselves as white-hat researchers. After Blockstream confirmed it had patched the flaw, they returned about 3,400 bitcoin and kept roughly 598.5 bitcoin, worth around $47 million, which they characterized as a self-appointed bounty. Ledger's chief technology officer and other researchers rejected the white-hat framing and compared the event to the Ronin bridge theft. Liquid remains paused. Rekt News has [catalogued the incident](https://www.rekt.news/) alongside the month's other federated and bridge failures.

Both interpretations benefit someone. If the attackers are researchers, keeping $47 million without a prior agreement is still an unauthorized taking, and it sets a price for future disclosure that no protocol negotiated. If they are thieves, the partial return was a practical hedge against being identified. Neither party has produced evidence that settles it.

The unresolved question is who absorbs the loss. Liquid's structure gives holders a claim on a federation, not on a chain, and the federation followed its own rules. Custodial insurance generally responds to key compromise and theft, not to correctly signed transactions authorized by faulty accounting software. That gap is the real finding here.

## What this means

The exposure runs to L-BTC holders and to the exchanges that used Liquid for fast inter-venue settlement, because their claim depends on a federation whose signing keys behaved correctly while the balance sheet behind them did not. For the wider market, insurers and institutional custody desks now have to price a category that most policies do not cover, namely a validly signed withdrawal against a reserve that software miscounted, and that repricing raises the cost of running any federated or multi-signature custody layer.

## What to watch

- Whether Liquid resumes peg-outs and on what terms for the missing 598 bitcoin. A resumption that quietly socializes the shortfall across holders would show federated sidechains carry an unpriced haircut risk.
- Whether any insurer publicly states that correctly signed but improperly qualified withdrawals fall inside or outside coverage. That answer sets the cost of institutional bitcoin custody across the sector.
- Whether Blockstream publishes a full technical post-mortem of the Elements defect. Silence would push exchanges to reduce reliance on the sidechain rather than wait.